René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Data race in `sys_set_flag` when `sys.set_int_max_str_digits()` is called concurrently with free-threaded build","articleBody":"# Bug report\n\n### Bug description:\n\n`sys.set_int_max_str_digits()` updates `sys.flags` via `sys_set_flag()`, which modifies a shared struct-sequence slot without synchronization:\n\nhttps://github.com/python/cpython/blob/ce916dc50644bb1de940f5fb580bd9907cceb959/Python/sysmodule.c#L3479-L3487\n\nConcurrent callers race on the slot and can `Py_XDECREF` the same `old_value`, leading to a use-after-free of the old flag object.\n\nReproducer:\n```python\nimport sys\nfrom threading import Thread\n\ndef thread1():\n    for i in range (20000):\n        sys.set_int_max_str_digits(4300 + (i \u0026 7))\n\nthreads = [Thread(target=thread1) for _ in range(4)]\nfor t in threads: t.start()\nfor t in threads: t.join()\n```\n\nTSAN Report:\n```\n==================\nWARNING: ThreadSanitizer: data race (pid=1518581)\n  Read of size 8 at 0x7fffb63e01b8 by thread T1:\n    #0 PyStructSequence_GetItem /cpython/Objects/structseq.c:112:12  \n    #1 sys_set_flag /cpython/./Python/sysmodule.c:3484:27  \n    #2 _PySys_SetFlagObj /cpython/./Python/sysmodule.c:3498:5 \n    #3 _PySys_SetFlagInt /cpython/./Python/sysmodule.c:3512:15  \n    #4 _PySys_SetIntMaxStrDigits /cpython/./Python/sysmodule.c:4671:9 \n    #5 sys_set_int_max_str_digits_impl /cpython/./Python/sysmodule.c:1894:9  \n    #6 sys_set_int_max_str_digits /cpython/./Python/clinic/sysmodule.c.h:932:20 \n    #7 _Py_BuiltinCallFastWithKeywords_StackRef /cpython/Python/ceval.c:839:11  \n    #8 _PyEval_EvalFrameDefault /cpython/Python/generated_cases.c.h:2508:35 \n\n  Previous write of size 8 at 0x7fffb63e01b8 by thread T2:\n    #0 PyStructSequence_SetItem /cpython/Objects/structseq.c:100:27  \n    #1 sys_set_flag /cpython/./Python/sysmodule.c:3485:5  \n    #2 _PySys_SetFlagObj /cpython/./Python/sysmodule.c:3498:5 \n    #3 _PySys_SetFlagInt /cpython/./Python/sysmodule.c:3512:15  \n    #4 _PySys_SetIntMaxStrDigits /cpython/./Python/sysmodule.c:4671:9 \n    #5 sys_set_int_max_str_digits_impl /cpython/./Python/sysmodule.c:1894:9  \n    #6 sys_set_int_max_str_digits /cpython/./Python/clinic/sysmodule.c.h:932:20 \n    #7 cfunction_vectorcall_FASTCALL_KEYWORDS /cpython/Objects/methodobject.c:465:24  \n    #8 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:144:11  \n    #9 PyObject_Vectorcall /cpython/Objects/call.c:327:12\n...\nSUMMARY: ThreadSanitizer: data race /cpython/Objects/structseq.c:112:12 in PyStructSequence_GetItem\n==================\n==================\nWARNING: ThreadSanitizer: data race (pid=1518581)\n  Read of size 4 at 0x7fffc004057c by thread T2:\n    #0 _Py_ExplicitMergeRefcount /cpython/Objects/object.c:477:40  \n    #1 _Py_brc_queue_object /cpython/Python/brc.c:73:31  \n    #2 _Py_DecRefSharedIsDead /cpython/Objects/object.c:413:9  \n    #3 _Py_DecRefSharedDebug /cpython/Objects/object.c:425:9 \n    #4 _Py_DecRefShared /cpython/Objects/object.c:433:5 \n    #5 Py_DECREF /cpython/./Include/refcount.h:385:9  \n    #6 Py_XDECREF /cpython/./Include/refcount.h:520:9 \n    #7 sys_set_flag /cpython/./Python/sysmodule.c:3486:5 \n    #8 _PySys_SetFlagObj /cpython/./Python/sysmodule.c:3498:5 \n    #9 _PySys_SetFlagInt /cpython/./Python/sysmodule.c:3512:15  \n    #10 _PySys_SetIntMaxStrDigits /cpython/./Python/sysmodule.c:4671:9 \n    #11 sys_set_int_max_str_digits_impl /cpython/./Python/sysmodule.c:1894:9  \n    #12 sys_set_int_max_str_digits /cpython/./Python/clinic/sysmodule.c.h:932:20 \n\n  Previous atomic write of size 4 at 0x7fffc004057c by thread T3:\n    #0 _Py_atomic_store_uint32_relaxed /cpython/./Include/cpython/pyatomic_gcc.h:493:3  \n    #1 Py_DECREF /cpython/./Include/refcount.h:379:9 \n    #2 Py_XDECREF /cpython/./Include/refcount.h:520:9 \n    #3 sys_set_flag /cpython/./Python/sysmodule.c:3486:5 \n    #4 _PySys_SetFlagObj /cpython/./Python/sysmodule.c:3498:5 \n    #5 _PySys_SetFlagInt /cpython/./Python/sysmodule.c:3512:15  \n    #6 _PySys_SetIntMaxStrDigits /cpython/./Python/sysmodule.c:4671:9 \n    #7 sys_set_int_max_str_digits_impl /cpython/./Python/sysmodule.c:1894:9  \n    #8 sys_set_int_max_str_digits /cpython/./Python/clinic/sysmodule.c.h:932:20 \n...\nSUMMARY: ThreadSanitizer: data race /cpython/Objects/object.c:477:40 in _Py_ExplicitMergeRefcount\n==================\n==================\nWARNING: ThreadSanitizer: data race (pid=1518581)\n  Read of size 8 at 0x7fffc4042720 by thread T3:\n    #0 long_dealloc /cpython/Objects/longobject.c:3653:9  \n    #1 _Py_Dealloc /cpython/Objects/object.c:3312:5  \n    #2 _Py_brc_queue_object /cpython/Python/brc.c  \n    #3 _Py_DecRefSharedIsDead /cpython/Objects/object.c:413:9  \n    #4 _Py_DecRefSharedDebug /cpython/Objects/object.c:425:9 \n    #5 _Py_DecRefShared /cpython/Objects/object.c:433:5 \n    #6 Py_DECREF /cpython/./Include/refcount.h:385:9  \n    #7 Py_XDECREF /cpython/./Include/refcount.h:520:9 \n    #8 sys_set_flag /cpython/./Python/sysmodule.c:3486:5 \n    #9 _PySys_SetFlagObj /cpython/./Python/sysmodule.c:3498:5 \n    #10 _PySys_SetFlagInt /cpython/./Python/sysmodule.c:3512:15  \n    #11 _PySys_SetIntMaxStrDigits /cpython/./Python/sysmodule.c:4671:9 \n    #12 sys_set_int_max_str_digits_impl /cpython/./Python/sysmodule.c:1894:9  \n    #13 sys_set_int_max_str_digits /cpython/./Python/clinic/sysmodule.c.h:932:20 \n\n  Previous write of size 8 at 0x7fffc4042720 by thread T4:\n    #0 _PyLong_SetSignAndDigitCount /cpython/./Include/internal/pycore_long.h:307:27  \n    #1 _PyLong_FromMedium /cpython/Objects/longobject.c:267:5 \n    #2 PyLong_FromLong /cpython/Objects/longobject.c:409:5  \n    #3 _PySys_SetFlagInt /cpython/./Python/sysmodule.c:3507:21  \n    #4 _PySys_SetIntMaxStrDigits /cpython/./Python/sysmodule.c:4671:9 \n    #5 sys_set_int_max_str_digits_impl /cpython/./Python/sysmodule.c:1894:9  \n    #6 sys_set_int_max_str_digits /cpython/./Python/clinic/sysmodule.c.h:932:20 \n...\nSUMMARY: ThreadSanitizer: data race /cpython/Objects/longobject.c:3653:9 in long_dealloc\n==================\n```\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nLinux\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-151220\n* gh-151402\n* gh-151552\n* gh-151553\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/Naserume","@type":"Person","name":"Naserume"},"datePublished":"2026-06-10T03:58:54.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/151218/cpython/issues/151218"}